SpooqW

Data Processing Agreement

Last updated: July 2026 · Version 1.0

This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("you", the "Controller") and Aretè Tecnologia di Antonio Sambataro("SpooqW", "we", the "Processor"), VAT IT05945010873, Belpasso (CT) 95032, Italy, and governs our processing of personal data contained in your Customer Data on your behalf. It reflects the requirements of Article 28 of the GDPR. Where this DPA conflicts with the Terms of Service on data-protection matters, this DPA prevails. Capitalised terms not defined here have the meaning given in the Terms or the GDPR.

1. Roles of the parties

For Customer Data processed through the Service, you are the controller (or a processor acting on behalf of your own controllers) and we are the processor. Each party will comply with its obligations under the GDPR. For your account and billing data, we act as an independent controller, as described in our Privacy Policy — that processing is outside the scope of this DPA.

2. Subject matter, duration, nature and purpose (Annex I)

  • Subject matter — our processing of personal data contained in Customer Data to provide the SpooqW data lakehouse platform.
  • Duration — for the term of your subscription plus the return/deletion period in Section 9.
  • Nature and purpose — hosting, ingestion, transformation, storage, querying, orchestration and back-up of Customer Data through data pipelines and the Iceberg lakehouse, strictly to provide and support the Service on your instructions.

3. Categories of data subjects and personal data

Because you control what you ingest, the categories of data subjects and personal data are determined by you. They may include, for example, your employees, customers, suppliers and end users, and any personal data present in the source systems, files and streams you connect. You are responsible for not sending us special categories of data (Article 9) unless you have a lawful basis and have configured appropriate protections, and for ensuring you have a valid legal basis for the processing you instruct.

4. Our obligations as processor (Article 28)

  • Instructions — we process Customer Data only on your documented instructions (including as set out in the Terms and this DPA), unless required by EU or Member State law, in which case we will inform you unless that law prohibits it.
  • Confidentiality — persons authorised to process Customer Data are bound by appropriate confidentiality obligations.
  • Security — we implement the technical and organisational measures described in Section 6.
  • Sub-processing — we engage sub-processors only under the conditions in Section 5.
  • Assistance — we assist you, taking into account the nature of processing, in responding to data-subject requests (Section 7) and in meeting your obligations under Articles 32–36 (security, breach notification, impact assessments and prior consultation).
  • Deletion / return — on termination we return or delete Customer Data as set out in Section 9.
  • Demonstrating compliance — we make available the information necessary to demonstrate compliance and allow for audits under Section 8.

We will not sell Customer Data or use it for our own purposes, including to train AI models.

5. Sub-processors

You give general authorisation for us to engage the sub-processors listed below to help provide the Service, each under a written contract imposing data-protection obligations no less protective than this DPA. Our current sub-processors (Annex II) are:

  • Stripe — payment processing (account/billing data; generally not present in Customer Data pipelines).
  • Resend — transactional email delivery.
  • OpenRouter — AI model routing for assistant / generation features. On self-hosted / sovereign deployments you may direct AI features to your own on-premise inference, in which case no Customer Data reaches OpenRouter.
  • Cloud / VPS hosting provider — infrastructure hosting for the cloud platform and lakehouse (EU region).
  • Cloudflare — DNS, network security and Turnstile anti-abuse.

We will inform you of any intended addition or replacement of a sub-processor with reasonable prior notice (by email and/or an in-product or website notice), giving you the opportunity to object on reasonable data-protection grounds. If you self-host SpooqW, you control your own infrastructure and most of these sub-processors do not apply to your Customer Data.

6. Security measures (Article 32)

We maintain technical and organisational measures appropriate to the risk, including:

  • Encryption in transit (TLS) for all connections to the Service.
  • Encryption at rest for sensitive secrets — connection credentials are encrypted with AES-256-GCM; passwords are stored only as salted hashes.
  • Strict per-tenant isolation and role-based access controls, on a least-privilege, need-to-know basis.
  • Audit logging of platform activity.
  • Regular backups and tested recovery procedures.
  • Monitoring and anti-abuse controls, and processes to review and improve these measures over time.

7. Assisting with data-subject requests

Taking into account the nature of the processing, we will provide reasonable assistance — including appropriate technical and organisational measures and self-service tooling in the platform — to help you respond to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection). If we receive a request directly relating to your Customer Data, we will refer the data subject to you rather than respond ourselves, unless legally required to act.

8. Personal data breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting your Customer Data, and provide the information reasonably available to help you meet your own notification obligations under Articles 33 and 34. Our notification is not an acknowledgement of fault or liability.

9. Audits

We will make available information reasonably necessary to demonstrate compliance with Article 28 and this DPA, and allow for and contribute to audits, including inspections, conducted by you or an independent auditor mandated by you. Audits are subject to reasonable prior notice, confidentiality obligations, and a frequency and scope that do not disrupt our operations; we may satisfy audit requests by providing existing documentation or summaries of measures where appropriate.

10. Return and deletion on termination

On termination or expiry of the Service, and at your choice, we will return or delete Customer Data (and existing copies) within a reasonable period, unless EU or Member State law requires storage. Because lakehouse tables are stored in the open Apache Iceberg format, you can export them before termination using any Iceberg-compatible engine. Residual data in routine backups is deleted in the ordinary backup-rotation cycle.

11. International transfers

We host the cloud Service in the European Union and prioritise EU data residency. Where a sub-processor processes personal data outside the EEA, the transfer is protected by an appropriate Chapter V safeguard — typically the European Commission's Standard Contractual Clauses (SCCs), supplemented by additional safeguards, or an adequacy decision. Self-hosted deployments keep Customer Data on your own infrastructure, so no transfer to us occurs for that data.

12. General

This DPA takes effect for the duration of the Service. In case of conflict, the SCCs (where they apply) prevail over this DPA, and this DPA prevails over the Terms on data-protection matters. Liability under this DPA is subject to the limitations in the Terms of Service. For DPA questions or to exercise rights under it, contact asambataro@aretetecnologia.com.